Pedes Orange County, Inc.

On November 14, 2017, PEDES Orange County, Inc., the covered entity (CE), discovered that a physician from another medical group accessed the CE’s electronic medical records (EMR) database and disclosed such information to an unauthorized individual, affecting 917 individuals. The types of protected health information (PHI) involved in the breach included patients’ names and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and established a dedicated call center to assist individuals affected by the breach incident. Following the breach and in response to OCR’s investigation, the CE suspended the physician’s access to its EMR system and implemented technical safeguards including a new EMR system with increased access controls. OCR provided technical assistance on the Security Rule.